CVE-2025-0511

High

Published: 12 February 2025

Published

12 February 2025

Modified

20 February 2025

KEV Added

—

Patch

—

CVSS Score v3.1 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

EPSS Score 0.0090 76.1th percentile

Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-0511 is a high-severity Cross-site Scripting (CWE-79) vulnerability in Welcart Welcart E-Commerce. Its CVSS base score is 7.2 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Browser Session Hijacking (T1185); ranked in the top 23.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).

Deeper analysis

The Welcart e-Commerce plugin for WordPress, also known as usc-e-shop, contains a stored cross-site scripting vulnerability in all versions through 2.11.9. The flaw is triggered via the ‘name’ parameter because of missing input sanitization and output escaping, and it is tracked as CWE-79 with a CVSS 3.1 score of 7.2.

Unauthenticated attackers can supply crafted input that is persisted by the plugin and later executed in the browser of any visitor who views the affected page. Successful exploitation allows injection of arbitrary scripts with changed scope, resulting in limited impacts to confidentiality and integrity but no direct availability loss.

A fix is available in changeset 3235131 on the WordPress plugin repository, and administrators are advised to update to a version newer than 2.11.9. The Wordfence advisory and plugin changelog confirm the remediation was released after disclosure on 12 February 2025.

EPSS values remain low, with a current score of 0.0090 and a peak of only 0.0117, indicating no significant post-disclosure exploitation interest.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2025-1727

Vulnerability details

The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘name’ parameter in all versions up to, and including, 2.11.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to…

inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CWE(s): CWE-79

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1185 Browser Session Hijacking Collection

Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify user-behaviors, and intercept information as part of various browser session hijacking techniques.

attack.mitre.org →

T1491.002 External Defacement Impact

An adversary may deface systems external to an organization in an attempt to deliver messaging, intimidate, or otherwise mislead an organization or users.

attack.mitre.org →

T1528 Steal Application Access Token Credential Access

Adversaries can steal application access tokens as a means of acquiring credentials to access remote systems and resources.

attack.mitre.org →

Why these techniques?

Stored XSS directly enables browser script execution for session hijacking (T1185), external defacement (T1491.002), and stealing web/app tokens or cookies (T1528).

Confidence: MEDIUM · MITRE ATT&CK Enterprise v18.1